search

elastic / kibana

Your window into the Elastic Stack
https://www.elastic.co/products/kibana
Other
19.69k stars 8.12k forks source link

[SIEM] [Detection Engine] Provide API to duplicate Rules #58287

Open spong opened 4 years ago

spong commented 4 years ago

Currently we're using the _bulk_create API when duplicating rules, which results in having to null out all the fields that shouldn't be there on create like enabled, updated_by, etc. This conceals a failure point if any additional fields are added to rules that can't be set on create (which we ran into during 7.6 FF). Having a dedicated duplicate endpoint that takes either a list of ID's, or a query (in effort to support select all rules on all pages functionality) would clean this up while also providing a more semantic API for creating copies of rules.

Current API call for the duplicate rule action:

https://github.com/elastic/kibana/blob/f890776e6dbc353132f2d392447b77951498dad3/x-pack/legacy/plugins/siem/public/containers/detection_engine/rules/api.ts#L183-L201

elasticmachine commented 4 years ago

Pinging @elastic/siem (Team:SIEM)